Cyber Resilience

CVE-2024-45407

MediumPublic PoC

Published: 10 September 2024

Published
10 September 2024
Modified
20 September 2024
KEV Added
Patch
CVSS Score v3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
EPSS Score 0.0037 59.0th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-45407 is a medium-severity Channel Accessible by Non-Endpoint (CWE-300) vulnerability in Lizardbyte Sunshine. Its CVSS base score is 6.5 (Medium).

Operationally, ranked in the top 41.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

EU & UK References

Vulnerability details

Sunshine is a self-hosted game stream host for Moonlight. Clients that experience a MITM attack during the pairing process may inadvertantly allow access to an unintended client rather than failing authentication due to a PIN validation error. The pairing attempt…

more

fails due to the incorrect PIN, but the certificate from the forged pairing attempt is incorrectly persisted prior to the completion of the pairing request. This allows access to the certificate belonging to the attacker.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

lizardbyte
sunshine
2024-05-27

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-300

Ensures only authenticated endpoints can access the communication channel, blocking unauthorized non-endpoint access.

addresses: CWE-300

Physically restricts transmission channels so they cannot be accessed or tapped by non-endpoint actors within facilities.

addresses: CWE-300

Periodic TSCM surveys identify unauthorized access points or taps that make communication channels reachable by non-endpoint adversaries.

addresses: CWE-300

Explicitly isolates the communications path so it cannot be accessed or intercepted by non-endpoint entities during security functions.

addresses: CWE-300

Restrictions and channel controls reduce the chance that VoIP media or signaling streams remain accessible to non-participants.

addresses: CWE-300

Directly prevents non-endpoint access or interception of the session communication path.

addresses: CWE-300

An out-of-band channel is inaccessible to non-endpoints that can observe or interfere with the primary communication channel.

addresses: CWE-300

The control restricts an inherently broadcast wireless channel to only intended endpoints, mitigating accessibility by non-endpoints.

References